From b48779ea7084278d494e436386d06fd5e55161d6 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Fri, 8 Oct 2021 10:17:03 +0200
Subject: [PATCH 1/3] SESSION_COOKIE_SECURE and HTTP won't work

---
 core/admin/mailu/ui/templates/login.html | 12 ++++++++++++
 towncrier/newsfragments/1996.enhancement |  1 +
 2 files changed, 13 insertions(+)
 create mode 100644 towncrier/newsfragments/1996.enhancement

diff --git a/core/admin/mailu/ui/templates/login.html b/core/admin/mailu/ui/templates/login.html
index fb8e5bd4..118173cb 100644
--- a/core/admin/mailu/ui/templates/login.html
+++ b/core/admin/mailu/ui/templates/login.html
@@ -7,3 +7,15 @@
 {%- block subtitle %}
 {% trans %}to access the administration tools{% endtrans %}
 {%- endblock %}
+
+{%+ block content %}
+{% if config["SESSION_COOKIE_SECURE"] %}
+<script language="javascript">
+	if(window.location.protocol != "https:") {
+		document.write('<div class="alert alert-danger" role="alert">The login form has been disabled as <b>SESSION_COOKIE_SECURE</b> is on but you are accessing Mailu over HTTP</div>');
+		window.stop();
+	}
+</script>
+{% endif %}
+{{ super() }}
+{%+ endblock %}
diff --git a/towncrier/newsfragments/1996.enhancement b/towncrier/newsfragments/1996.enhancement
new file mode 100644
index 00000000..d1bc2ccf
--- /dev/null
+++ b/towncrier/newsfragments/1996.enhancement
@@ -0,0 +1 @@
+Disable the login page if SESSION_COOKIE_SECURE is incompatible with how Mailu is accessed as this seems to be a common misconfiguration.

From aaf3ddd002b87dfccd09e82a00830364a19aeed1 Mon Sep 17 00:00:00 2001
From: Alexander Graf <ghostwheel42@users.noreply.github.com>
Date: Fri, 8 Oct 2021 19:54:31 +0200
Subject: [PATCH 2/3] moved javascript to app.js

---
 core/admin/assets/app.js                 |  7 +++++++
 core/admin/mailu/ui/templates/login.html | 15 ++++++---------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/core/admin/assets/app.js b/core/admin/assets/app.js
index dc3414f2..5df8052c 100644
--- a/core/admin/assets/app.js
+++ b/core/admin/assets/app.js
@@ -66,5 +66,12 @@ $('document').ready(function() {
     // init clipboard.js
     new ClipboardJS('.btn-clip');
 
+    // disable login if not possible
+    var l = $('#login_needs_https');
+    if (l.length && window.location.protocol != 'https:') {
+        l.removeClass("d-none");
+        $('form :input').prop('disabled', true);
+    }
+
 });
 
diff --git a/core/admin/mailu/ui/templates/login.html b/core/admin/mailu/ui/templates/login.html
index 118173cb..4c38d134 100644
--- a/core/admin/mailu/ui/templates/login.html
+++ b/core/admin/mailu/ui/templates/login.html
@@ -8,14 +8,11 @@
 {% trans %}to access the administration tools{% endtrans %}
 {%- endblock %}
 
-{%+ block content %}
 {% if config["SESSION_COOKIE_SECURE"] %}
-<script language="javascript">
-	if(window.location.protocol != "https:") {
-		document.write('<div class="alert alert-danger" role="alert">The login form has been disabled as <b>SESSION_COOKIE_SECURE</b> is on but you are accessing Mailu over HTTP</div>');
-		window.stop();
-	}
-</script>
-{% endif %}
+{%- block content %}
+<div id="login_needs_https" class="alert alert-danger d-none" role="alert">
+{% trans %}The login form has been disabled as <b>SESSION_COOKIE_SECURE</b> is on but you are accessing Mailu over HTTP.{% endtrans %}
+</div>
 {{ super() }}
-{%+ endblock %}
+{%- endblock %}
+{% endif %}

From d131d863baca9616bb2251aa44dd658167888966 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sat, 9 Oct 2021 15:44:56 +0200
Subject: [PATCH 3/3] The if needs to be inside the block

---
 core/admin/mailu/ui/templates/login.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/admin/mailu/ui/templates/login.html b/core/admin/mailu/ui/templates/login.html
index 4c38d134..d4d115db 100644
--- a/core/admin/mailu/ui/templates/login.html
+++ b/core/admin/mailu/ui/templates/login.html
@@ -8,11 +8,11 @@
 {% trans %}to access the administration tools{% endtrans %}
 {%- endblock %}
 
-{% if config["SESSION_COOKIE_SECURE"] %}
 {%- block content %}
+{% if config["SESSION_COOKIE_SECURE"] %}
 <div id="login_needs_https" class="alert alert-danger d-none" role="alert">
 {% trans %}The login form has been disabled as <b>SESSION_COOKIE_SECURE</b> is on but you are accessing Mailu over HTTP.{% endtrans %}
 </div>
+{% endif %}
 {{ super() }}
 {%- endblock %}
-{% endif %}